jam.saml.encryption¶

encryption ¶

Functions:

Name	Description
`decrypt_aes_key`	Decrypt an RSA-OAEP encrypted AES key.
`decrypt_assertion`	Decrypt a `<saml:EncryptedAssertion>` element.
`encrypt_aes_key`	Encrypt an AES key with RSA-OAEP.
`encrypt_assertion`	Encrypt a SAML Assertion element into an EncryptedAssertion.
`load_encryption_key`	Load an RSA public key from PEM for encryption.

decrypt_aes_key(
    encrypted_key_b64: str, private_key: RSAPrivateKey
) -> bytes

Decrypt an RSA-OAEP encrypted AES key.

Parameters:

Name	Type	Description	Default
`encrypted_key_b64`	`str`	Base64-encoded encrypted AES key.	required
`private_key`	`RSAPrivateKey`	RSA private key for decryption.	required

Returns:

Type	Description
`bytes`	Decrypted 256-bit AES key bytes.

decrypt_assertion(
    enc_assertion_elem: Element, private_key: RSAPrivateKey
) -> Element

Decrypt a <saml:EncryptedAssertion> element.

Extracts the RSA-OAEP wrapped AES key, decrypts it, then decrypts the assertion XML payload.

Parameters:

Name	Type	Description	Default
`enc_assertion_elem`	`Element`	The `<saml:EncryptedAssertion>` element.	required
`private_key`	`RSAPrivateKey`	Recipient's RSA private key.	required

Returns:

Type	Description
`Element`	Decrypted `<saml:Assertion>` element.

Raises:

Type	Description
`JamSAMLValidationError`	If decryption fails or structure is invalid.

encrypt_aes_key(
    aes_key: bytes, public_key: RSAPublicKey
) -> str

Encrypt an AES key with RSA-OAEP.

Parameters:

Name	Type	Description	Default
`aes_key`	`bytes`	256-bit AES key bytes.	required
`public_key`	`RSAPublicKey`	RSA public key for encryption.	required

Returns:

Type	Description
`str`	Base64-encoded encrypted AES key.

encrypt_assertion(
    assertion_elem: Element, public_key: RSAPublicKey
) -> Element

Encrypt a SAML Assertion element into an EncryptedAssertion.

Generates a random AES-256-GCM key, encrypts the canonicalized assertion XML with it, then wraps the AES key with RSA-OAEP.

Parameters:

Name	Type	Description	Default
`assertion_elem`	`Element`	The `<saml:Assertion>` element to encrypt.	required
`public_key`	`RSAPublicKey`	Recipient's RSA public key.	required

Returns:

Type	Description
`Element`	`<saml:EncryptedAssertion>` element.

load_encryption_key(pem: str) -> RSAPublicKey

Load an RSA public key from PEM for encryption.

Parameters:

Name	Type	Description	Default
`pem`	`str`	PEM-encoded RSA public key or certificate.	required

Returns:

Type	Description
`RSAPublicKey`	RSA public key.